As computer technology has advanced, so too has the need for computer security. One significant area of concern with computer security is the security of data stored by a user of the computer. Such security can include, for example, security against another user reading the data, another user modifying the data (either maliciously or unintentionally), etc. One manner in which such security is currently provided is through encryption. Using encryption, only those users who are supposed to have access to the data (e.g., those users with the decryption key) are able to decrypt and read (and/or modify) the data.
However, situations arise in which encryption creates additional problems. One such situation is in the case where the data is to be verified as being in accordance with a certain set of rules (e.g., a naming syntax), while at the same time maintaining the security/privacy of the data. Current systems typically cannot perform such verifications without reading the underlying data.
For example, in some situations where computers are networked together it would be desirable to have a distributed file system in which different files could be stored on different machines in the network. However, in order to maintain security of the data in the files, it would be beneficial to be able to render both the data and the filename itself unreadable at the computer on which the file is stored, thereby preventing another unauthorized user from gathering information about the data by either reading the data file or the filename. However, maintaining a directory of such encrypted/protected filenames can lead to difficulties, especially due to the fact that the user of the computer on which the data file or filename is stored may not be authorized to read the file. Care must be taken to ensure that the filename syntax is not violated and that duplicate filenames do not exist. Current systems do not have the ability to maintain such a directory of non-duplicate filenames that do not violate the naming syntax while at the same time can be verified by a component that is not authorized to read the filenames.
The invention described below addresses these disadvantages, providing methods and systems for encryption that excludes syntactically illegal plaintext from being encrypted and that enables a party without access to encryption keys to exclude more than one item of ciphertext that decrypts to the same plaintext. For this reason, the invention is referred to as “exclusive encryption.”